pyric-tools 0.1.0-alpha.7

package/dist/credentials/node/file-store.js

@@ -0,0 +1,52 @@
+/**
+ * Node `CredentialStore` over a JSON file (default `~/.pyric/credentials.json`).
+ * Hardened per the pre-mortem: writes are atomic (temp + rename), the file is
+ * `0600` (it holds a refresh token), and `read()` returns `null` on a missing OR
+ * corrupt/unknown file — it never throws, so a damaged store reads as logged-out.
+ */
+import { readFile, writeFile, rename, mkdir, chmod, unlink } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { homedir } from 'node:os';
+export function defaultCredentialPath() {
+    return join(homedir(), '.pyric', 'credentials.json');
+}
+export function fileCredentialStore(path = defaultCredentialPath()) {
+    return {
+        async read() {
+            let raw;
+            try {
+                raw = await readFile(path, 'utf-8');
+            }
+            catch {
+                return null; // missing -> logged out
+            }
+            try {
+                const parsed = JSON.parse(raw);
+                if (parsed && parsed.version === 1 && typeof parsed.refreshToken === 'string' && Array.isArray(parsed.scopes)) {
+                    return parsed;
+                }
+                return null; // unknown shape -> logged out (don't trust a partial/old file)
+            }
+            catch {
+                return null; // corrupt JSON -> logged out, never throw
+            }
+        },
+        async write(cred) {
+            await mkdir(dirname(path), { recursive: true });
+            const tmp = `${path}.${process.pid}.tmp`;
+            await writeFile(tmp, JSON.stringify(cred, null, 2), { mode: 0o600 });
+            await chmod(tmp, 0o600); // belt-and-suspenders vs umask
+            await rename(tmp, path); // atomic swap
+            await chmod(path, 0o600);
+        },
+        async clear() {
+            try {
+                await unlink(path);
+            }
+            catch {
+                /* already gone */
+            }
+        },
+    };
+}
+//# sourceMappingURL=file-store.js.map

package/dist/credentials/node/file-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-store.js","sourceRoot":"","sources":["../../../src/credentials/node/file-store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAGlC,MAAM,UAAU,qBAAqB;IACnC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAe,qBAAqB,EAAE;IACxE,OAAO;QACL,KAAK,CAAC,IAAI;YACR,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,CAAC,wBAAwB;YACvC,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA8B,CAAC;gBAC5D,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC9G,OAAO,MAA0B,CAAC;gBACpC,CAAC;gBACD,OAAO,IAAI,CAAC,CAAC,+DAA+D;YAC9E,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,CAAC,0CAA0C;YACzD,CAAC;QACH,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,IAAsB;YAChC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;YACzC,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACrE,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,+BAA+B;YACxD,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,cAAc;YACvC,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,KAAK;YACT,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/credentials/node/from-adc.d.ts

@@ -0,0 +1,10 @@
+import type { ProjectScope } from '../core/types.js';
+/** The well-known ADC file path (honours CLOUDSDK_CONFIG; %APPDATA% on Windows). */
+export declare function adcWellKnownPath(env?: NodeJS.ProcessEnv): string;
+/**
+ * Build a `ProjectScope` from ADC, or `null` if no ADC file is present. The
+ * project is supplied by the caller — an ADC user credential isn't bound to one
+ * (`--project` / `.firebaserc`).
+ */
+export declare function fromAdc(projectId: string, env?: NodeJS.ProcessEnv, path?: string): Promise<ProjectScope | null>;
+//# sourceMappingURL=from-adc.d.ts.map

package/dist/credentials/node/from-adc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-adc.d.ts","sourceRoot":"","sources":["../../../src/credentials/node/from-adc.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAMrD,oFAAoF;AACpF,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAK7E;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAC3B,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,GAAE,MAA8B,GACnC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAgC9B"}

package/dist/credentials/node/from-adc.js

@@ -0,0 +1,60 @@
+/**
+ * Application Default Credentials source — the gcloud / workload-identity path,
+ * the modern keyless alternative to a long-lived token. Reads the well-known ADC
+ * file (`gcloud auth application-default login`):
+ *   - `authorized_user` -> refresh-token grant (the common dev case).
+ *   - `service_account` -> delegate to `fromServiceAccount`.
+ * The metadata-server path (GCE / Cloud Run) is a separate fallback, not yet
+ * wired. Node-only (reads disk) -> lives in node/.
+ */
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { oauthClient } from '../core/client.js';
+import { exchangeRefreshToken } from '../core/exchange.js';
+import { fromServiceAccount } from '../../deploy/from-service-account.js';
+import { memoizeTtl } from '../../deploy/memoize-ttl.js';
+/** The well-known ADC file path (honours CLOUDSDK_CONFIG; %APPDATA% on Windows). */
+export function adcWellKnownPath(env = process.env) {
+    const base = env.CLOUDSDK_CONFIG ??
+        (process.platform === 'win32' && env.APPDATA ? join(env.APPDATA, 'gcloud') : join(homedir(), '.config', 'gcloud'));
+    return join(base, 'application_default_credentials.json');
+}
+/**
+ * Build a `ProjectScope` from ADC, or `null` if no ADC file is present. The
+ * project is supplied by the caller — an ADC user credential isn't bound to one
+ * (`--project` / `.firebaserc`).
+ */
+export async function fromAdc(projectId, env = process.env, path = adcWellKnownPath(env)) {
+    let raw;
+    try {
+        raw = await readFile(path, 'utf-8');
+    }
+    catch {
+        return null; // no ADC file
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.type === 'authorized_user' && parsed.client_id && parsed.client_secret && parsed.refresh_token) {
+        const client = oauthClient({ clientId: parsed.client_id, clientSecret: parsed.client_secret });
+        const refreshToken = parsed.refresh_token;
+        const resolveToken = memoizeTtl(async () => {
+            const { access_token, expires_in } = await exchangeRefreshToken(client, refreshToken);
+            return { token: access_token, expiresIn: expires_in };
+        });
+        return Object.freeze({ projectId, resolveToken });
+    }
+    if (parsed.type === 'service_account') {
+        const sa = await fromServiceAccount(raw); // fromServiceAccount accepts a raw JSON string
+        return projectId && projectId !== sa.projectId
+            ? Object.freeze({ projectId, resolveToken: sa.resolveToken })
+            : sa;
+    }
+    return null; // unknown ADC type (e.g. external_account) — not supported here
+}
+//# sourceMappingURL=from-adc.js.map

package/dist/credentials/node/from-adc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-adc.js","sourceRoot":"","sources":["../../../src/credentials/node/from-adc.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,oFAAoF;AACpF,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,MAAM,IAAI,GACR,GAAG,CAAC,eAAe;QACnB,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrH,OAAO,IAAI,CAAC,IAAI,EAAE,sCAAsC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,SAAiB,EACjB,MAAyB,OAAO,CAAC,GAAG,EACpC,OAAe,gBAAgB,CAAC,GAAG,CAAC;IAEpC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,cAAc;IAC7B,CAAC;IACD,IAAI,MAA6F,CAAC;IAClG,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1G,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;QAC/F,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,CAAC;QAC1C,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE;YACzC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACtF,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,+CAA+C;QACzF,OAAO,SAAS,IAAI,SAAS,KAAK,EAAE,CAAC,SAAS;YAC5C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC;YAC7D,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAED,OAAO,IAAI,CAAC,CAAC,gEAAgE;AAC/E,CAAC"}

package/dist/credentials/node/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Node-only credential surface (`pyric-tools/credentials/node`): the filesystem
+ * adapters + the local-token resolver. Separate from the browser-safe
+ * `pyric-tools/credentials` barrel because these touch the filesystem
+ * (`~/.pyric/credentials.json`, ADC). Server-side only.
+ */
+export { resolveLocalAccessToken, type LocalAccessToken, type LocalCredentialSource, type ResolveLocalTokenOptions, } from './resolve-local-token.js';
+export { fileCredentialStore, defaultCredentialPath } from './file-store.js';
+export { fromAdc } from './from-adc.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/credentials/node/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/credentials/node/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,uBAAuB,EACvB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,GAC9B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC"}

package/dist/credentials/node/index.js

@@ -0,0 +1,10 @@
+/**
+ * Node-only credential surface (`pyric-tools/credentials/node`): the filesystem
+ * adapters + the local-token resolver. Separate from the browser-safe
+ * `pyric-tools/credentials` barrel because these touch the filesystem
+ * (`~/.pyric/credentials.json`, ADC). Server-side only.
+ */
+export { resolveLocalAccessToken, } from './resolve-local-token.js';
+export { fileCredentialStore, defaultCredentialPath } from './file-store.js';
+export { fromAdc } from './from-adc.js';
+//# sourceMappingURL=index.js.map

package/dist/credentials/node/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/credentials/node/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,uBAAuB,GAIxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC"}

package/dist/credentials/node/loopback-authorizer.d.ts

@@ -0,0 +1,12 @@
+import type { Authorizer } from '../core/types.js';
+export interface LoopbackDeps {
+    /** Open the consent URL. Injected: the browser opener in production, a fake in
+     *  tests. May fail/no-op (headless) — the URL is printed regardless. */
+    openUrl: (url: string) => void | Promise<void>;
+    /** Status + paste-fallback output. */
+    print: (line: string) => void;
+    /** Abort after this many ms. Default 120s. */
+    timeoutMs?: number;
+}
+export declare function loopbackAuthorizer(deps: LoopbackDeps): Authorizer;
+//# sourceMappingURL=loopback-authorizer.d.ts.map

package/dist/credentials/node/loopback-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback-authorizer.d.ts","sourceRoot":"","sources":["../../../src/credentials/node/loopback-authorizer.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAqC,MAAM,kBAAkB,CAAC;AAQtF,MAAM,WAAW,YAAY;IAC3B;4EACwE;IACxE,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,sCAAsC;IACtC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,YAAY,GAAG,UAAU,CAiDjE"}

package/dist/credentials/node/loopback-authorizer.js

@@ -0,0 +1,61 @@
+/**
+ * Node loopback `Authorizer`: bind a localhost server on an ephemeral port, open
+ * the consent URL, and catch Google's redirect. Pre-mortem hardening: port `0`
+ * (never "address in use"), a hard timeout, `state` validation (CSRF), single-
+ * settle, and an injected `openUrl` so a headless box falls back to the printed
+ * URL (and so tests can drive the redirect without a real browser).
+ */
+import { createServer } from 'node:http';
+const page = (title, body) => `<!doctype html><meta charset=utf-8><title>pyric</title>` +
+    `<body style="font-family:system-ui;padding:3rem;max-width:32rem"><h2>${title}</h2><p>${body}</p>`;
+const SUCCESS_HTML = page('Signed in to pyric', 'You can close this tab and return to your terminal.');
+const ERROR_HTML = page('Sign-in was cancelled', 'Return to your terminal and try again.');
+export function loopbackAuthorizer(deps) {
+    return {
+        authorize(req) {
+            return new Promise((resolve, reject) => {
+                let redirectUri = '';
+                let settled = false;
+                const finish = (fn) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    clearTimeout(timer);
+                    server.close();
+                    fn();
+                };
+                const server = createServer((rq, rs) => {
+                    const u = new URL(rq.url ?? '/', redirectUri || 'http://127.0.0.1');
+                    if (u.pathname !== '/') {
+                        rs.writeHead(404).end();
+                        return;
+                    }
+                    const error = u.searchParams.get('error');
+                    const code = u.searchParams.get('code');
+                    const state = u.searchParams.get('state');
+                    const ok = !error && !!code && state === req.state;
+                    rs.writeHead(ok ? 200 : 400, { 'content-type': 'text/html' }).end(ok ? SUCCESS_HTML : ERROR_HTML);
+                    if (error)
+                        return finish(() => reject(new Error(`sign-in cancelled (${error})`)));
+                    if (!code)
+                        return finish(() => reject(new Error('sign-in: no authorization code in the redirect')));
+                    if (state !== req.state) {
+                        return finish(() => reject(new Error('sign-in: state mismatch (possible CSRF) — aborted')));
+                    }
+                    finish(() => resolve({ code, redirectUri }));
+                });
+                const timer = setTimeout(() => finish(() => reject(new Error('sign-in timed out. Run `pyric login` to retry.'))), deps.timeoutMs ?? 120_000);
+                server.on('error', (e) => finish(() => reject(e)));
+                server.listen(0, '127.0.0.1', () => {
+                    const addr = server.address();
+                    redirectUri = `http://127.0.0.1:${typeof addr === 'object' && addr ? addr.port : 0}`;
+                    const authUrl = req.buildUrl(redirectUri);
+                    deps.print('Opening your browser to sign in...');
+                    deps.print(`   or open: ${authUrl}`);
+                    void Promise.resolve(deps.openUrl(authUrl)).catch(() => deps.print('(could not open a browser automatically — open the URL above)'));
+                });
+            });
+        },
+    };
+}
+//# sourceMappingURL=loopback-authorizer.js.map

package/dist/credentials/node/loopback-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback-authorizer.js","sourceRoot":"","sources":["../../../src/credentials/node/loopback-authorizer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAGzC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,IAAY,EAAE,EAAE,CAC3C,yDAAyD;IACzD,wEAAwE,KAAK,WAAW,IAAI,MAAM,CAAC;AACrG,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,EAAE,qDAAqD,CAAC,CAAC;AACvG,MAAM,UAAU,GAAG,IAAI,CAAC,uBAAuB,EAAE,wCAAwC,CAAC,CAAC;AAY3F,MAAM,UAAU,kBAAkB,CAAC,IAAkB;IACnD,OAAO;QACL,SAAS,CAAC,GAAqB;YAC7B,OAAO,IAAI,OAAO,CAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACtD,IAAI,WAAW,GAAG,EAAE,CAAC;gBACrB,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,MAAM,MAAM,GAAG,CAAC,EAAc,EAAQ,EAAE;oBACtC,IAAI,OAAO;wBAAE,OAAO;oBACpB,OAAO,GAAG,IAAI,CAAC;oBACf,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,EAAE,EAAE,CAAC;gBACP,CAAC,CAAC;gBACF,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE;oBACrC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE,WAAW,IAAI,kBAAkB,CAAC,CAAC;oBACpE,IAAI,CAAC,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;wBACvB,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;wBACxB,OAAO;oBACT,CAAC;oBACD,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAC1C,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBACxC,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAC1C,MAAM,EAAE,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,KAAK,GAAG,CAAC,KAAK,CAAC;oBACnD,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;oBAClG,IAAI,KAAK;wBAAE,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;oBAClF,IAAI,CAAC,IAAI;wBAAE,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC,CAAC,CAAC;oBACpG,IAAI,KAAK,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC;wBACxB,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC,CAAC,CAAC;oBAC9F,CAAC;oBACD,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;gBAC/C,CAAC,CAAC,CAAC;gBACH,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC,CAAC,EACvF,IAAI,CAAC,SAAS,IAAI,OAAO,CAC1B,CAAC;gBACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnD,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;oBACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC9B,WAAW,GAAG,oBAAoB,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrF,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;oBAC1C,IAAI,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;oBACjD,IAAI,CAAC,KAAK,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC;oBACrC,KAAK,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CACrD,IAAI,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAC5E,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/credentials/node/resolve-local-token.d.ts

@@ -0,0 +1,20 @@
+import type { CredentialStore } from '../core/types.js';
+export type LocalCredentialSource = 'service-account' | 'login' | 'adc';
+export interface LocalAccessToken {
+    accessToken: string;
+    /** Epoch ms, when the source reports a lifetime. */
+    expiresAt?: number;
+    source: LocalCredentialSource;
+    /** Present for the `login` source (from the stored credential). */
+    email?: string;
+}
+export interface ResolveLocalTokenOptions {
+    env?: NodeJS.ProcessEnv;
+    /** Injectable for tests. */
+    store?: CredentialStore;
+    /** Placeholder project for the ProjectScope; the access token itself is not
+     *  project-bound (cloud-platform). Defaults to `'local'`. */
+    projectId?: string;
+}
+export declare function resolveLocalAccessToken(opts?: ResolveLocalTokenOptions): Promise<LocalAccessToken | null>;
+//# sourceMappingURL=resolve-local-token.d.ts.map

package/dist/credentials/node/resolve-local-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-local-token.d.ts","sourceRoot":"","sources":["../../../src/credentials/node/resolve-local-token.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,kBAAkB,CAAC;AAItE,MAAM,MAAM,qBAAqB,GAAG,iBAAiB,GAAG,OAAO,GAAG,KAAK,CAAC;AAExE,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,4BAA4B;IAC5B,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB;iEAC6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAsBD,wBAAsB,uBAAuB,CAC3C,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAqDlC"}

package/dist/credentials/node/resolve-local-token.js

@@ -0,0 +1,97 @@
+/**
+ * `resolveLocalAccessToken` — mint a Google access token from whatever durable
+ * credential exists on the local machine, for a LOCAL server (e.g. the
+ * playground's `astro dev` `/api` routes) that wants to act on the user's
+ * behalf without a browser OAuth flow.
+ *
+ * Precedence (first that mints wins):
+ *   1. Service account  — `FIREBASE_SA_BASE64` / `GOOGLE_APPLICATION_CREDENTIALS`
+ *   2. `pyric login`    — `~/.pyric/credentials.json`, refreshed with the OAuth
+ *                         client from `PYRIC_OAUTH_CLIENT_ID`/`_SECRET`. If the
+ *                         client env is absent or the refresh fails (expired /
+ *                         revoked token), we FALL THROUGH to ADC rather than
+ *                         letting a stale login block a working credential.
+ *   3. ADC              — `gcloud auth application-default login`
+ *
+ * Returns `null` when nothing can mint (caller shows a "run `pyric login` /
+ * `gcloud auth application-default login`" hint). Node-only: reads credential
+ * files via the existing `credentials/` adapters — never by hand.
+ */
+import { fromServiceAccount } from '../../deploy/index.js';
+import { oauthClient } from '../core/client.js';
+import { fromUserCredential } from '../core/from-user-credential.js';
+import { defaultCredentialPath, fileCredentialStore } from './file-store.js';
+import { fromAdc } from './from-adc.js';
+/**
+ * Normalize `ProjectScope.resolveToken()`, whose runtime shape is inconsistent:
+ * the service-account/ADC path returns a raw `string`, while the user-credential
+ * (pyric login) path returns `{ token, expiresIn }`. (The declared type is
+ * `Promise<string>`; the object case is a latent contract wart in
+ * `from-user-credential`.) Handle both.
+ */
+async function mint(scope) {
+    const r = await scope.resolveToken();
+    if (typeof r === 'string')
+        return { token: r };
+    if (r && typeof r === 'object' && 'token' in r) {
+        const o = r;
+        return {
+            token: String(o.token),
+            ...(typeof o.expiresIn === 'number' ? { expiresIn: o.expiresIn } : {}),
+        };
+    }
+    throw new Error('resolveToken returned an unexpected shape');
+}
+export async function resolveLocalAccessToken(opts = {}) {
+    const env = opts.env ?? process.env;
+    const projectId = opts.projectId ?? 'local';
+    const withExpiry = (token, expiresIn) => typeof expiresIn === 'number' ? { expiresAt: Date.now() + expiresIn * 1000 } : {};
+    // 1. Service account (env).
+    const saSpec = env.FIREBASE_SA_BASE64?.trim()
+        ? `base64:${env.FIREBASE_SA_BASE64}`
+        : env.GOOGLE_APPLICATION_CREDENTIALS?.trim() || null;
+    if (saSpec) {
+        try {
+            const { token, expiresIn } = await mint(await fromServiceAccount(saSpec));
+            return { accessToken: token, source: 'service-account', ...withExpiry(token, expiresIn) };
+        }
+        catch {
+            /* fall through */
+        }
+    }
+    // 2. pyric login — only attempt when the OAuth client env is present to
+    //    refresh it. On any refresh failure (expired/revoked), fall through.
+    const clientId = env.PYRIC_OAUTH_CLIENT_ID;
+    if (clientId?.trim()) {
+        const store = opts.store ?? fileCredentialStore(defaultCredentialPath());
+        const cred = await store.read();
+        if (cred) {
+            try {
+                const client = oauthClient({ clientId, clientSecret: env.PYRIC_OAUTH_CLIENT_SECRET });
+                const { token, expiresIn } = await mint(fromUserCredential(cred, client, projectId));
+                return {
+                    accessToken: token,
+                    source: 'login',
+                    ...(cred.email ? { email: cred.email } : {}),
+                    ...withExpiry(token, expiresIn),
+                };
+            }
+            catch {
+                /* stale login → fall through to ADC */
+            }
+        }
+    }
+    // 3. ADC (gcloud / workload identity).
+    try {
+        const scope = await fromAdc(projectId, env);
+        if (scope) {
+            const { token, expiresIn } = await mint(scope);
+            return { accessToken: token, source: 'adc', ...withExpiry(token, expiresIn) };
+        }
+    }
+    catch {
+        /* fall through */
+    }
+    return null;
+}
+//# sourceMappingURL=resolve-local-token.js.map

package/dist/credentials/node/resolve-local-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-local-token.js","sourceRoot":"","sources":["../../../src/credentials/node/resolve-local-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAsBxC;;;;;;GAMG;AACH,KAAK,UAAU,IAAI,CAAC,KAAmB;IACrC,MAAM,CAAC,GAAY,MAAO,KAAK,CAAC,YAAY,EAAuB,CAAC;IACpE,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC/C,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,GAAG,CAA4C,CAAC;QACvD,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YACtB,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAiC,EAAE;IAEnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC;IAC5C,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,SAA6B,EAAE,EAAE,CAClE,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpF,4BAA4B;IAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;QAC3C,CAAC,CAAC,UAAU,GAAG,CAAC,kBAAkB,EAAE;QACpC,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IACvD,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1E,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;QAC5F,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,QAAQ,GAAG,GAAG,CAAC,qBAAqB,CAAC;IAC3C,IAAI,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,mBAAmB,CAAC,qBAAqB,EAAE,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,CAAC,yBAAyB,EAAE,CAAC,CAAC;gBACtF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;gBACrF,OAAO;oBACL,WAAW,EAAE,KAAK;oBAClB,MAAM,EAAE,OAAO;oBACf,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5C,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC;iBAChC,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,uCAAuC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/C,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;QAChF,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/credentials/server/bff.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Backend-for-frontend (BFF) auth helpers — framework-agnostic. A browser can't
+ * do the OAuth code exchange (Google requires the client_secret and has no public
+ * client type) or hold a refresh token safely, so the exchange and the refresh
+ * token live on a server. These functions are that server logic, taking and
+ * returning plain values; the framework layer (e.g. Astro endpoints) wires them
+ * to httpOnly cookies + responses. Reuses the isomorphic core verbatim.
+ */
+import type { OAuthClient } from '../core/types.js';
+import { AuthExpired } from '../core/exchange.js';
+export { AuthExpired };
+/** Begin sign-in: the consent URL + the state/verifier to stash (as httpOnly
+ *  cookies) for the callback to validate. */
+export declare function startAuth(opts: {
+    client: OAuthClient;
+    redirectUri: string;
+    scopes: readonly string[];
+}): Promise<{
+    authUrl: string;
+    state: string;
+    verifier: string;
+}>;
+/** Complete sign-in: validate state, exchange the code server-side (with the
+ *  secret), and return the refresh token to persist in an httpOnly cookie. */
+export declare function completeAuth(opts: {
+    client: OAuthClient;
+    code: string;
+    returnedState: string;
+    expectedState: string | undefined;
+    verifier: string | undefined;
+    redirectUri: string;
+}): Promise<{
+    refreshToken: string;
+}>;
+/** Issue a fresh access token from the stored refresh token. Throws `AuthExpired`
+ *  when the refresh token is revoked/expired so the caller can clear the cookie. */
+export declare function refreshAccess(opts: {
+    client: OAuthClient;
+    refreshToken: string;
+}): Promise<{
+    accessToken: string;
+    expiresIn: number;
+}>;
+//# sourceMappingURL=bff.d.ts.map

package/dist/credentials/server/bff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bff.d.ts","sourceRoot":"","sources":["../../../src/credentials/server/bff.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EAA0C,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAE1F,OAAO,EAAE,WAAW,EAAE,CAAC;AAEvB;6CAC6C;AAC7C,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,MAAM,EAAE,WAAW,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAWhE;AAED;8EAC8E;AAC9E,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAepC;AAED;oFACoF;AACpF,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,MAAM,EAAE,WAAW,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAGtD"}

package/dist/credentials/server/bff.js

@@ -0,0 +1,43 @@
+import { buildAuthUrl, pkce, randomState } from '../core/authorize.js';
+import { exchangeAuthCode, exchangeRefreshToken, AuthExpired } from '../core/exchange.js';
+export { AuthExpired };
+/** Begin sign-in: the consent URL + the state/verifier to stash (as httpOnly
+ *  cookies) for the callback to validate. */
+export async function startAuth(opts) {
+    const { verifier, challenge } = await pkce();
+    const state = randomState();
+    const authUrl = buildAuthUrl({
+        client: opts.client,
+        scopes: opts.scopes,
+        redirectUri: opts.redirectUri,
+        challenge,
+        state,
+    });
+    return { authUrl, state, verifier };
+}
+/** Complete sign-in: validate state, exchange the code server-side (with the
+ *  secret), and return the refresh token to persist in an httpOnly cookie. */
+export async function completeAuth(opts) {
+    if (!opts.expectedState || opts.returnedState !== opts.expectedState) {
+        throw new Error('bff: state mismatch (possible CSRF) — aborted');
+    }
+    if (!opts.verifier)
+        throw new Error('bff: missing PKCE verifier');
+    const tokens = await exchangeAuthCode({
+        client: opts.client,
+        code: opts.code,
+        verifier: opts.verifier,
+        redirectUri: opts.redirectUri,
+    });
+    if (!tokens.refresh_token) {
+        throw new Error('bff: Google returned no refresh token (re-consent required)');
+    }
+    return { refreshToken: tokens.refresh_token };
+}
+/** Issue a fresh access token from the stored refresh token. Throws `AuthExpired`
+ *  when the refresh token is revoked/expired so the caller can clear the cookie. */
+export async function refreshAccess(opts) {
+    const tokens = await exchangeRefreshToken(opts.client, opts.refreshToken);
+    return { accessToken: tokens.access_token, expiresIn: tokens.expires_in };
+}
+//# sourceMappingURL=bff.js.map

package/dist/credentials/server/bff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bff.js","sourceRoot":"","sources":["../../../src/credentials/server/bff.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAE1F,OAAO,EAAE,WAAW,EAAE,CAAC;AAEvB;6CAC6C;AAC7C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAI/B;IACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,YAAY,CAAC;QAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,SAAS;QACT,KAAK;KACN,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC;AAED;8EAC8E;AAC9E,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAOlC;IACC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;AAChD,CAAC;AAED;oFACoF;AACpF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAGnC;IACC,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;AAC5E,CAAC"}

package/dist/deploy/api-enablement.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Deploy preflight: ensure the Google APIs a target needs are enabled on the
+ * project BEFORE any mutation.
+ *
+ * Auto-enables the missing APIs when the caller has permission
+ * (roles/serviceusage.serviceUsageAdmin or Owner); when it can't, prints the
+ * per-API console link and fails fast so the user can enable manually and retry.
+ *
+ * Why a preflight, not login: API enablement is per-project, login is project-
+ * agnostic, and an API can be disabled after login. This mirrors firebase-tools'
+ * `ensureApiEnabled` at deploy time. See design rationale
+ *
+ * Pure fetch over Service Usage v1 (`services.get` to detect,
+ * `services:batchEnable` + long-running-operation poll to enable). No `node:*`
+ * imports — same host-agnostic shape as preflight.ts.
+ */
+import type { ProjectScope } from './scope.js';
+interface Sink {
+    write(s: string): void;
+}
+export interface EnsureApisResult {
+    ok: boolean;
+    /** Process exit code when `ok` is false: 1 = needs manual action (no
+     *  permission), 2 = runtime/transport failure. */
+    exit?: number;
+}
+export interface EnsureApisOptions {
+    scope: ProjectScope;
+    apis: readonly string[];
+    out: Sink;
+    err: Sink;
+    /** Injectable for tests; default to global fetch / real timers / Date.now. */
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+}
+/**
+ * Ensure every API in `apis` is enabled on the project. Returns `{ ok: true }`
+ * when all are (already, or after a successful enable); `{ ok: false, exit }`
+ * when enablement is needed but the caller lacks permission (console links
+ * printed) or a transport/operation failure occurs.
+ */
+export declare function ensureApisEnabled(opts: EnsureApisOptions): Promise<EnsureApisResult>;
+export {};
+//# sourceMappingURL=api-enablement.d.ts.map

package/dist/deploy/api-enablement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-enablement.d.ts","sourceRoot":"","sources":["../../src/deploy/api-enablement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAQ/C,UAAU,IAAI;IACZ,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ;sDACkD;IAClD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,YAAY,CAAC;IACpB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,IAAI,CAAC;IACV,8EAA8E;IAC9E,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAsCD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAyG1F"}